Technical Information
Malicious functions
Injects code into
the following user processes:
- dllhost.exe
Searches for registry branches where third party applications store passwords
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
Reads files which store third party applications passwords
- D:\users\user\appdata\local\google\chrome\user data\default\web data
- D:\users\user\appdata\local\google\chrome\user data\default\login data
- D:\users\user\appdata\local\google\chrome\user data\default\cookies
Modifies file system
Creates the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive0.dat
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
- D:\programdata\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
- D:\programdata\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
- D:\programdata\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
- D:\windows\system32\microsoft\protect\s-1-5-18\user\preferred
- D:\windows\system32\microsoft\protect\s-1-5-18\user\9341006a-1eeb-4cb2-a2cc-3edb710f0a2b
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\config\software
- D:\windows\system32\config\software.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\users\user\ntuser.dat
- D:\users\user\ntuser.dat.log1
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
- D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\vt9xta3x3wskll3o79fc.temp
Deletes the following files
- D:\users\user\appdata\roaming\mozilla\firefox\profiles\0j9e9tku.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal
Moves the following files
- from D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\vt9xta3x3wskll3o79fc.temp to D:\users\user\appdata\roaming\microsoft\windows\recent\customdestinations\969252ce11249fdd.customdestinations-ms
Network activity
Connects to
- '17#.#3.142.201':80
TCP
HTTP GET requests
- http://catalog.s.download.windowsupdate.com/img/favicon.png
- http://17#.#3.142.201/img/favicon.png
Other
- 'localhost':49158
- 'co########gnature-2.cdn.mozilla.net':443
- '35.##1.9.150':443
Miscellaneous
Searches for the following windows
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: '#32770' WindowName: 'TeamViewer'
